If your defense contract includes FAR 52.204-21, you handle Federal Contract Information (FCI). That's information the government provides or you create under the contract that isn't meant for public release. CMMC Level 1 is how DoD checks that you protect it.
The good news is that Level 1 is the most approachable level of CMMC. Here's what it looks like in practice.
Step 1: Confirm Level 1 is your level
Start with the contract. If it involves FCI but not Controlled Unclassified Information (CUI), Level 1 applies. If it includes DFARS 7012 or CUI markings, you're likely looking at Level 2.
Step 2: Meet the 15 basic safeguards
Level 1 comes down to 15 security requirements. In everyday terms, they fall into five groups:
- Who gets in: only authorized people and devices can use your systems, and each user only gets the access they need
- Passwords and identity: every user and device is identified, and logins require authentication
- Physical security: limit who can enter your office, escort visitors, keep a visitor log, and control keys and badges
- Protecting your systems: keep public-facing systems separate from internal ones, control external connections, and watch what gets posted publicly
- Keeping things clean: patch promptly, run antivirus, keep it updated, scan for malware, and wipe or destroy media before disposal
Every requirement has to be fully met. Level 1 doesn't allow partial credit or a Plan of Action and Milestones (POA&M) to finish later.
Step 3: Do the self-assessment
Walk through each requirement and confirm it's actually in place, not just written in a policy. Keep simple evidence like screenshots, settings exports, and your visitor log.
Step 4: Post it in SPRS
Enter your results in the Supplier Performance Risk System (SPRS).
Step 5: Affirm it every year
A senior official at your company has to affirm compliance in SPRS every year. Treat it like a yearly checkup, not a one-time project.
Where to go next
- CMMC Level 1 requirements: all 15 safeguards in detail
- CMMC Level 1 vs Level 2: which one applies to you
- CMMC Level 1 readiness: how we help
Cyberneza is a veteran-owned, 100% US-based cybersecurity firm in Orlando. If you'd like help getting Level 1 done right the first time, reach out here.